Extracted

• • Target

    630ab459be2675ab53b9a3e4eeba9110_JaffaCakes118

  • Size

    1.5MB

  • MD5

    630ab459be2675ab53b9a3e4eeba9110

  • SHA1

    77f8b36c24cd0de2dcfe86b96e403bfad9d91112

  • SHA256

    a5a60f5bef193b80117238e77eb20fccf1c72809dbf5af44bc588ab591b41c61

  • SHA512

    33dce0472a05889df913693b80d4002a7dfab036f0201fa38d011cb7d9406146d6f34525023ed24131efa2ad754fad8715eec6359fe47350d1ffb45ca03525ff

  • SSDEEP

    24576:DMy8p4zRy+JVnFog4DMut/u5V43Z1RcMzBPjcqIN/XlMMl/2hsXEjCuokNUxj+w:DMy8WlyoflsMsmjQZ1RcMzBLcqIBu+G2

  Score

  10^/10

  buerevasionloaderpersistence

  • Buer

    Buer is a new modular loader first seen in August 2019.

    loaderbuer

  • Buer Loader

    Detects Buer loader in memory or disk.

    loader

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2